Privacy Compliance and Security SLA: CSA addressing the challenges

Transcription

1 Privacy Compliance and Security SLA: CSA addressing the challenges Daniele Catteddu, Managing Director EMEA & OCF-STAR Program Director - Cloud Security Alliance Arthur van der Wees, Managing Director international law firm Arthur s Legal Dr. Paolo Balboni, Chair - CSA Privacy Level Agreement Working Group; Founding Partner - ICT LEGAL CONSULTING; Scientific Director - European Privacy Association Cloud Security Alliance, 2014.

2 ABOUT THE CLOUD SECURITY ALLIANCE To promote the use of best practices for providing security assurance within Cloud Computing, and provide education on the uses of Cloud Computing to help secure all other forms of computing. Global, not-for-profit organization Over 65,000 individual members, more than 200 corporate members, and 65 chapters Building best practices and a trusted cloud ecosystem Agile philosophy, rapid development of applied research GRC: Balance compliance with risk management Reference models: build using existing standards Identity: a key foundation of a functioning cloud economy Champion interoperability Enable innovation Advocacy of prudent public policy Cloud Security Alliance, 2014.

3 ABOUT THE CLOUD SECURITY ALLIANCE To promote the use of best practices for providing security assurance within Cloud Computing, and provide education on the uses of Cloud Computing to help secure all other forms of computing. RESEARCH ADVISE GOVERNMENTS AND PRIVATE COMPANIES EDUCATION PROFESSIONAL CERTIFICATION TRAINING PROVIDER CERTIFICATION STANDARDS Events Cloud Security Alliance, 2014.

4 Cloud Procurement Barriers

5 PICSE: Cloud service procurement The overarching objective of PICSE is to set up a European Procurers Platform capable of raising the level of understanding of the issues surrounding procurement of cloud services PICSE stakeholders Procurement specialists Public Research Organisations Funding agencies, national research agencies & councils SMEs & private sector Policy Makers Cloud Service Providers Associations of local government & procurers Public sector Decision Makers General Public About PICSE H2020 Coordination and Support Action Total budget: 500 K Duration: 18 months Start date: 1 Oct Partners: 03/12/2014 InfoSecurity,

6 Cloud Procurement: needs and requirements 03/12/2014 InfoSecurity,

7 Cloud Procurement: Challenges 03/12/2014 InfoSecurity,

8 Cloud Procurement: Barriers 03/12/2014 InfoSecurity,

9 Cloud Procurement: What to improve? 03/12/2014 InfoSecurity,

10 Cloud SLA

11 Cloud SLAs, SLA Life Cycle & SLA Ready Arthur van der Wees, Managing Director international law firm Arthur s Legal InfoSecurity, 2015

12 Massive Productivity Growth Necessary: technology is key Financial Times (26 May 2015)

13 Risks, Comfort, Trust in & Rewards of the Cloud Cloud Services Challenges: For the 80% not yet using cloud services, insufficient knowledge is the main blocking factors (42%). For the 20% using cloud services, the risk of a security breach is the main limiting factor (39%). Eurostat (EC) Cybersecurity & Data Protection: Threat or Strength? Microsoft Azure (ISO 27018) 13

14 Cloud Banking Europe (April 2015)

15 Cloud Computing, SLAs & European Commission European Commission Priority: Digital Single Market C-SIG Drafting Group DG CNECT: Select expert group (CSA, IBM, Microsoft, Telecom Italia and Arthur s Legal): EC Cloud SLA Standardisation Guidelines, ISO and other standardisation. SLA Ready: This 2015/2016 project and its consortium partners help out contributing to a common understanding as well as more standardisation and transparency of cloud SLAs, so companies can make an informed decision what to use and what to expect and

16

17 MISSION SLA READY Making Cloud SLAs readily usable in the private sector Increase the uptake of cloud computing by making it easier for SMEs to understand SLAs Improve transparency in SLAs for SaaS & IaaS Increase the amount of standardised terms and metrics in SLAs Bridge the disconnect between supply and demand through common vocabularies Provide user-friendly decision making tools and services Helping out companies to make an informed decision about what cloud services to use, and what to expect and trust. Contributing to common understanding, more standardization and transparency.

18 EC Cloud SLA Standardisation Guidelines: 4 Main categories Service Level Objectives (SLOs): Performance Security Data Management Personal Data Protection SLA Life Cycle: Assess, Select, SLA, Execute, Monitor, Update & Terminate Data Life Cycle: Create/derive, Store, Use/Process, Share, Archive, Destroy

19 Cloud Service Level Ecosystem #Cloud #Trust #Strategy #Performance #Security #Data #Data Protection #SLAReady SLAs are an important but yet only one particle in the Cloud Service Level Ecosystem:

20 Cloud Service Level Ecosystem Technology Human Standardisation & Certification (Self-regulatory) Cloud SLA & Other Contractual Arrangements Risk Allocation & Insurance Law & Legislation Case Law Ethics & Accountability

21 EC Security Service Objectives Chapter 4 EC SLA Standardisation Guidelines 4.1. Service Reliability 4.2. Authentication & Authorization 4.3. Cryptography 4.4. Security Incident management and reporting 4.5. Logging and Monitoring 4.6. Auditing and security verification 4.7. Vulnerability Management 4.8. Governance Service changes Human Factor Technology Cloud SLA & Other agreements Risk Allocation & Insurance Standardisation & Certification Law, Legislation & Case law Ethics & Accountability

22

23 Cloud SLA Legal Life Cycle When zooming in at one (1) SLA from a legal, negotiation and contract management perspective, the life cycle of a SLA can be split in seven (7) headline legal life cycle phases: 1. Assessment 2. Preparation 3. Negotiation & Contracting 4. Execution & Operation 5. Updates & Amendments 6. Escalation, and; 7. Termination & Consequences of Termination

24 State of Practice vs State of Art Current maturity level of Cloud SLAs of CSPs: 1. Difficult to find, difficult to read & assess: Lot s of push-back at CSPs 2. Performance: Availability, Uptime & Measurements 3. Incident Management: Response time per prioritised incident 4. Carve-outs & other exclusions: Planned Maintenance, Force Majeure, customer, third parties 5. Less than 10% coverage out of the EC SLA Standardisation Guidelines 6. Difficult to monitor, manage & enforce: status.aws.amazon.com (real-time system status & status history (35 days)), trust.salesforce.com (real-time system status & planned maintenance), (real-time system status & status history (up to 1 year))

25 Qualitative vs quantitative Service Levels? It is a Service! For a customer/user it may be quite different from traditional IT & utilities. Customer is king? Quality of Living, Mercer: Vienna (1), Zurich (2), Amsterdam (11), London (40) Measuring 36 metrics: Security, International connectivity, Public logistics, Quality of architecture and design, Tolerance, Mobility, Business conditions, Pro-active developments, Environmental responsibility, Medical and other care. Experience Level Agreement (xla): it s a feeling! Experience, Perception & Feel versus Facts, Standards & (Post-)commodity Building block thinking, multi-flavoured, new USPs, upsell potential #SLA per vertical #SLA per use #SLA for a day # Build your SLA

26 PRIVACY LEVEL AGREEMENT Cloud Security Alliance, 2014.

27 EU Privacy Compliance CSA PRIVACY LEVEL AGREEMENT and EC CODE of CONDUCT

28 EC C-SIG Privacy Code of Conduct Cloud Security Alliance, 2014.

29 EU Cloud Strategy

30 Privacy CoC: Purpose and Scope The Code is a voluntary instrument, allowing a CSP to evaluate and demonstrate its adherence to the Code s requirements. The purpose of this Code is to instil trust and confidence among cloud customers that: the personal data to be processed under the CSP Service Agreement (the customer s personal data) are processed with an appropriate level of data protection; an adhering CSP has met the applicable requirements as set out in this Code related to the processing of personal data, in accordance with the EU Data Protection Directive and its national transpositions. The Code applies mainly to Data Processors

31 Conditions of adherence (i) self-evaluation and self-declaration of compliance, or (ii) by relying on third-party certification. Any CSP may sign up to the Code, irrespective of where personal data is stored and processed. CSPs that have demonstrated their adherence to the Code in accordance with its governance processes may use the Code s relevant compliance marks.

32 Data Protection Requirements Contractual specification of the terms and conditions of the CSP s services Processing Personal Data lawfully Transfer of the customer s personal data within the CSP s Group Transfer of the customer s personal data to a subcontractor Right to audit Liability Cooperation with the customer Data Subject complaint handling Data Protection Authority request handling Confidentiality obligations Law enforcement/governmental requests Data breach Termination of the Services Agreement

33 Security Requirements Availability Integrity Confidentiality Transparency Isolation Accountability

34 Status CoC was sent to Art29 WP on January 2015 for their review and potential endorsement Final (?) feedback expected very soon

35 PRIVACY LEVEL AGREEMENT Cloud Security Alliance, 2014.

36 Privacy Level Agreement - PLA V2 EU Compliance Tool

37 CSA Privacy Level Agreement (PLA [V1]) Goal: Encourage uniform, consistent and streamlined practices for CSPs in handling personal data Facilitate complete and more relevant disclosures Scope & methodology Follows EU Data Protection Directive 95/46/EC principles and EU Commission Proposal for General Data Protection Regulation Addresses WP29 Opinion 5/2012 on Cloud Computing European Data Protection Authorities guidelines on cloud contracts and use of cloud computing services

38 DPA s opinions on PLA?

39 CSA Privacy Level Agreement (PLA [V2]) - EU compliance tool!!!!!!!!!!!! Privacy(Level(Agreement(Working(Group! Privacy!Level!Agreement![V2]:! A!Compliance!Tool!for!Providing!Cloud!! Services!in!the!European!Union! The! PLA([V2]! has! been! developed! within! CSA! by! an! expert! Working! Group! composed! of! representatives! of! Cloud! Service! Providers,!local!Data!Protection!Authorities!and!independent!security!and!privacy!professionals;!co(chaired!by!Dr.!Paolo!Balboni! and!francoise!gilbert,!with!the!technical!supervision!of!daniele!catteddu.!! The!PLA!working!group!is!sponsored!by!!!!! May!2015! CLOUD SECURITY ALLIANCE PLA Working Group - PLA [V2]: A Compliance Tool for Providing Cloud Services in the European Union! Copyright 2015 Cloud Security Alliance. All rights reserved.!! Goal: Provide CSPs a tool to achieve EU-wide data protection compliance Provide cloud customer with a tool to evaluate CSP EU-wide data protection compliance Scope & Methodology Deals with the B2B scenario Follows EU current Data Protection Law Strongly based on WP29 Opinion 5/2012 on Cloud Computing, written in the light of ISO/IEC 27018, the Cloud Service Level Agreement Standardisation Guidelines, the work developed by the Cloud Select Industry Group on Code of Conduct, & the Cloud Accountability Project Considers differences between CSPcontroller and CSP-processor

40 Privacy Level Agreement V2 1. Identity of the CSP (and of representative in the EU as applicable), its role, and the contact information for the data protection inquiries 1. Ways in which the data will be processed - Personal data location - Subcontractors - Installation of software on cloud customer s system

41 Privacy Level Agreement V2 3. Data transfer identify on which legal ground: e.g., EU Commission adequacy decision, model contracts, Safe Harbor, Binding Corporate Rules (BCR) 4. Data security measures - Availability - Integrity - Confidentiality - Transparency - Isolation (purpose limitation) - Intervenability

42 Privacy Level Agreement V2 5. Monitoring 6. Personal Data breach notification 7. Data portability, migration, and transfer back assistance back

43 Privacy Level Agreement V2 8. Data retention, restitution, and deletion Data retention policy / Data retention for compliance with legal requirements Data restitution or deletion 9. Accountability 10. Cooperation 9. Legally required disclosure

44 PLA V2 Table (Annex 1)

45 NEXT STEP PLA [V3] global version

46 CLOUD CONTROL MATRIX (CCM) CONSENSUS ASSESSMENTS INITIATIVE QUESTIONNAIRE (CAIQ) Cloud Security Alliance, 2014.

47 WHAT IS THE CCM? First ever baseline control framework specifically designed for Cloud supply chain risk management: Delineates control ownership (Provider, Customer) An anchor for security and compliance posture measurement Provides a framework of 16 control domains Controls map to global regulations and security standards Industry Driven Effort: 120+ Peer Review Participants Participants: AICPA, Microsoft, McKesson, ISACA, Oracle Backbone of the Open Certification Framework and STAR Cloud Security Alliance, 2014.

48 CCM V CONTROL AREAS Cloud Security Alliance, 2014.

49 CCM v3.0.1 Current Version: Released July 10, 2014 Builds upon the 5 new domains introduced in v3.0 Mobile Security Supply Chain Management Transparency & Accountability; Interoperability & Portability Encryption & Key Management Continued improvements in controls including: Language and auditability Reduction of overlapping controls Removed Customer and Provider references within the language Cloud Security Alliance, 2014.

50 CCM v3.0.1 New and Updated Mappings including: AICPA 2014 TSC ISO/IEC PCI DSS v3.0 NIST SP R3 App J ENISA IAF 95/46/EC - European Union Data Protection Directive HIPAA / HITECH Act COBIT 5.0 Canada PIPEDA COPPA ODCA UM: PA R2.0 Cloud Security Alliance, 2014.

51 CAIQ v3.0.1 Current Version: Released July 10, 2014 Companion to CSA CCM v3.0.1 and aligned to CSA s Guidance Questions mapped to the compliance requirements in CCM v3.0.1 Helps organizations build assessment processes for cloud providers Helps cloud providers assess their own security posture Improved cohesion between CCM and CAIQ in v3.0.1 Questions updated to facilitate STAR measurement Cloud Security Alliance, 2014.

52 ALIGNMENT CCM & CAIQ Controls now directly referenced Numbering & questions linked to control Cloud Security Alliance, 2014.

53 FUTURE OF CCM Continue to improve controls: Auditability & Measurement Clarity Intent Revisit the development cycle Evaluate additional candidates for mapping Cloud Security Alliance, 2014.

54 OPEN CERTIFICATION FRAMEWORK (OCF) / STAR Program Cloud Security Alliance, 2014.

55 CERTIFICATION CHALLENGES Provide a globally relevant certification to reduce duplication of efforts Address localized, national-state and regional compliance needs Address industry specific requirements Address different assurance requirements Address certification staleness assure provider is still secure after point in time certification Do all of the above while recognizing the dynamic and fastchanging world that is cloud Cloud Security Alliance, 2014.

56 DEBATING AROUND CERTIFICATION FOR CLOUD The debate around cloud certification has been based on the following key aspects: Suitability of existing security certification/attestation schemes (e.g. ISO or SSAE16/SOC1-2-3) for the cloud market vs. the needs to introduce new schemes Mandatory vs. voluntary industry driven approaches Global vs. Regional/National schemes Cost Transparency Assurance and maturity/capability models Cloud Security Alliance, 2014.

57 CSA STAR: SECURITY, TRUST & ASSURANCE REGISTRY Launched in 2011, the CSA STAR is the first step in improving transparency and assurance in the cloud. Searchable registry to allow cloud customers to review the security practices of providers, accelerating their due diligence and leading to higher quality procurement experiences. Cloud Security Alliance, The STAR is a publicly accessible registry that documents the security controls provided by cloud computing offerings Helps users to assess the security of cloud providers It is based on a multilayered structure defined by Open Certification Framework Working Group

58 OPEN CERTIFICATION FRAMEWORK The CSA Open Certification Framework is an industry initiative to allow global, accredited, trusted certification of cloud providers. Cloud Security Alliance, 2014.

59 Certificates CSA STAR CERTIFICATION & ISO WHY CSA STAR Certification builds on ISO27001? Help organizations prioritize areas for improvement and lead them towards business excellence. ISO is the international standard for information security Considered as Gold Standard for information security There are over 20,000 organisations certified globally in over 120 countries. 20,000 15,000 10,000 5, Cloud Security Alliance, 2014.

60 ISO CRITICISMS ISO is updated every 8 years the controls become obsolete faster than that It is a one size fits all standard but there are some industry specific concerns it does not cover, ie it is not Cloud relevant Any standard can become a lowest common denominator People can certify any scope they like within their organisation to mislead clients It doesn't support transparency Cloud Security Alliance, 2014.

61 WHAT IS CSA STAR CERTIFICATION? The CSA STAR Certification is a rigorous third-party independent assessment of the security of a cloud service provider. Technology-neutral certification leverages the requirements of the ISO/IEC 27001:2013 & the CSA CCM Integrates ISO/IEC 27001:2013 with the CSA CCM as additional or compensating controls. Measures the capability levels of the cloud service. Evaluates the efficiency of an organization s ISMS and ensures the scope, processes and objectives are Fit for Purpose. Based upon the Plan, Do, Check, Act (PDCA) approach Enables the auditor to assess a company s performance, on long-term sustainability and risks, in addition to ensuring they are SLA driven. Cloud Security Alliance, 2014.

62 HOW DO YOU GET THERE? OPTIMIZATION MODEL The organization has an ad hoc and inconsistent approach to this privacy standard or practice. The organization has a consistent overall approach, but it is mostly undocumented. The organization has a documented, detailed approach, but no routine measurement or enforcement of it. Process is characterize d as a quantitative ly managed process. A quantitative ly managed process is a defined (capability level 3) process that is controlled using statistical and other quantitative Process that is improved based on an understandin g of the common causes of variation inherent in the process. No Approach Reactive Proactive techniques. Improving Innovating Cloud Security Alliance, 2014.

63 HOW TO TAKE THE JOURNEY No Approach Reactive Proactive Improving Innovating The organization has an ad hoc and inconsistent approach to this privacy standard or practice. The organization has a consistent overall approach, but it is mostly undocumented. The organization has a documented, detailed approach, but no routine measurement or enforcement of it. Process is characterize d as a quantitative ly managed process. A quantitative ly managed process is a defined (capability level 3) process that is controlled using statistical and other quantitative techniques. Process that is improved based on an understandin g of the common causes of variation inherent in the process. Cloud Security Alliance, 2014.

64 MANAGEMENT CAPABILITY / MATURITY: SCORES When an Organization is audited a Management Capability Score will be assigned to each of the control areas in the CCM. This will indicate the capability of the management in this area to ensure the control is operating effectively. The management capability of the controls will be scored on a scale of These scores have been divided into 5 different categories that describe the type of approach characteristic of each group of scores. Cloud Security Alliance, 2014.

65 APPROVING ASSESSORS They must demonstrate knowledge of the Cloud Sector Either through verifiable industry experience this can include though assessing organizations Or through completing CCSK certification or equivalent They must be a qualified auditor working a ISO accredited CB Evidence of conducting ISO assessments for a certification body accredited by an IAF member to ISO or their qualifications as an auditor for that organization. They must complete the CSA approved course qualifying them to audit the CCM for STAR Certification Cloud Security Alliance, 2014.

66 ACCREDITED CERTIFICATION BODIES Cloud Security Alliance, 2014.

67 WHO IS USING CSA STAR? Currently 135 Cloud Service Providers Word Wide have decided to be part of the STAR Program! That includes companies with either STAR Self Assessment (102) or STAR Certification (30) or STAR Attestation (3) Several other in the process of completing their auditing processes Cloud Security Alliance, 2014.

68 How about Governments & EU Institutions? Are they requesting CSA Cloud Security Alliance, 2014.

69 EC and EU Parliament The Directorate-General for Informatics (DIGIT) in a tender that aims to secure about 2500 VM & 2500 Terabytes of storage for a number of EU Institutions (75% of the volume will be reserved for the European Parliament, Council and other EU) requests the candidate tenders to make use of the CSA STAR program to show compliance with security requirements established by the European Security Agency (ENISA). Please check out Annex 2 Security Requirements. Cloud Security Alliance, 2014.

70 EC and EU Parliament The EC is just the last (and surely not the least) that recognises the values of our certification and assurance program, prior to them other Governments (e.g. UK, Spain, Taiwan, Singapore, Canada, etc.) has made direct reference to STAR and CCM. Cloud Security Alliance, 2014.

71 UK G-Cloud example Cloud Security Alliance, 2014.

72 OPEN CERTIFICATION FRAMEWORK The CSA Open Certification Framework is an industry initiative to allow global, accredited, trusted certification of cloud providers. Cloud Security Alliance, 2014.

73 OCF Level 3 CSA STAR Continuous will be based on a continuous auditing/assessment of relevant security properties. It will built on the following CSA best practices/standards: Cloud Control Matrix (CCM) Cloud Trust Protocol (CTP) CloudAudit (A6) CSA STAR Continuous is currently under development and the target date of delivery is Cloud Security Alliance, 2014.

74 ??? Cloud Security Alliance, 2015.

75 THANK YOU! CONTACT US Daniele Catteddu; Managing Director EMEA, Cloud Security r/ Cloud Security Alliance, 2015.

76 CONTACT US Please check: @SLAReady

77 Dr. Paolo Balboni, CONTACT US Chair - CSA Privacy Level Agreement Working Group; Founding Partner - ICT LEGAL CONSULTING; Scientific Director - European Privacy Association InfoSecurity Europe 2015 Olympia, United Kingdom 4 June 2015 Cloud Security Alliance, 2014.